- djm@cvs.openbsd.org 2004/12/22 02:13:19

     [cipher-ctr.c cipher.c]
     remove fallback AES support for old OpenSSL, as OpenBSD has had it for
     many years now; ok deraadt@
     (Id sync only: Portable will continue to support older OpenSSLs)

diff --git a/ChangeLog b/ChangeLog
index d6eff946496572c7f78e15048a179ea31e16e57e..6d957fdec81523e444446d6663eb0812e03a1fd1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,6 +30,11 @@
      behaviour for bsdauth is maintained by checking authctxt->valid in the
      bsdauth driver.  Note that any third-party kbdint drivers will now need
      to be able to handle responses for invalid logins.  ok markus@
+   - djm@cvs.openbsd.org 2004/12/22 02:13:19
+     [cipher-ctr.c cipher.c]
+     remove fallback AES support for old OpenSSL, as OpenBSD has had it for
+     many years now; ok deraadt@
+     (Id sync only: Portable will continue to support older OpenSSLs)
  - (dtucker) [auth-pam.c] Bug #971: Prevent leaking information about user
    existence via keyboard-interactive/pam, in conjunction with previous
    auth2-chall.c change; with Colin Watson and djm.

diff --git a/auth-pam.c b/auth-pam.c
index 0b79f3a25fcd7fef23e7e9e0657a157db13a277c..c9c3329539ee86d441a30b78c7410ee2fd1e19db 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -245,6 +245,17 @@ sshpam_password_change_required(int reqd)
        }
 }
 
+/* Check ssh internal flags in addition to PAM */
+
+static int
+sshpam_login_allowed(Authctxt *ctxt)
+{
+       if (ctxt->valid && (ctxt->pw->pw_uid != 0 ||
+           options.permit_root_login == PERMIT_YES))
+               return 1;
+       return 0;
+}
+
 /* Import regular and PAM environment from subprocess */
 static void
 import_environments(Buffer *b)
@@ -702,9 +713,7 @@ sshpam_query(void *ctx, char **name, char **info,
                                **prompts = NULL;
                        }
                        if (type == PAM_SUCCESS) {
-                               if (!sshpam_authctxt->valid ||
-                                   (sshpam_authctxt->pw->pw_uid == 0 &&
-                                   options.permit_root_login != PERMIT_YES))
+                               if (!sshpam_login_allowed(sshpam_authctxt))
                                        fatal("Internal error: PAM auth "
                                            "succeeded when it should have "
                                            "failed");
@@ -753,9 +762,7 @@ sshpam_respond(void *ctx, u_int num, char **resp)
                return (-1);
        }
        buffer_init(&buffer);
-       if (sshpam_authctxt->valid &&
-           (sshpam_authctxt->pw->pw_uid != 0 ||
-            options.permit_root_login == PERMIT_YES))
+       if (sshpam_login_allowed(sshpam_authctxt))
                buffer_put_cstring(&buffer, *resp);
        else
                buffer_put_cstring(&buffer, badpw);
@@ -1118,8 +1125,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
         * by PermitRootLogin, use an invalid password to prevent leaking
         * information via timing (eg if the PAM config has a delay on fail).
         */
-       if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
-            options.permit_root_login != PERMIT_YES))
+       if (!sshpam_login_allowed(authctxt))
                sshpam_password = badpw;
 
        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
@@ -1130,7 +1136,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
 
        sshpam_err = pam_authenticate(sshpam_handle, flags);
        sshpam_password = NULL;
-       if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
+       if (sshpam_err == PAM_SUCCESS && sshpam_login_allowed(authctxt)) {
                debug("PAM: password authentication accepted for %.100s",
                    authctxt->user);
                return 1;

diff --git a/cipher-ctr.c b/cipher-ctr.c
index 395dabedd554403b8211e5b6e74bdee8d2817d18..43f1ede571cb397c62ad944447661fa4ca0b7656 100644 (file)
--- a/cipher-ctr.c
+++ b/cipher-ctr.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: cipher-ctr.c,v 1.4 2004/02/06 23:41:13 dtucker Exp $");
+RCSID("$OpenBSD: cipher-ctr.c,v 1.5 2004/12/22 02:13:19 djm Exp $");
 
 #include <openssl/evp.h>
 

diff --git a/cipher.c b/cipher.c
index 075a4c5fceb0bda3426f63d75bae2dfc5879dba5..64be0571f431b188cf6f9ddc150547ff3a0010ca 100644 (file)
--- a/cipher.c
+++ b/cipher.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: cipher.c,v 1.71 2004/07/28 09:40:29 markus Exp $");
+RCSID("$OpenBSD: cipher.c,v 1.72 2004/12/22 02:13:19 djm Exp $");
 
 #include "xmalloc.h"
 #include "log.h"